Conversation

Notices

1. Embed this notice
   :mima_rule: Mima-sama (mima@makai.chaotic.ninja)'s status on Tuesday, 05-Mar-2024 19:28:01 JST :mima_rule: Mima-sama

   I've just done a bit more testing, since my friend emma in this Raddle thread was able to confirm in her own #Postmill instance (I've tested against #Raddle too because why not) that it's a caching reverse proxy causing images to stay longer on the server. I'm able to confirm that using a query string bypasses the proxy's cache and results in the expected 404. Hooray, and I couldn't expect any better from Raddle! :ai_yay: They always take #privacy seriously. :alice_wine:
   
   I've used this method against #Mastodon, #Pleroma, and #Misskey. The first two still returns the image I've uploaded even though I've deleted my account AND used a query string to bypass proxy cache (yikes). Misskey forcibly rewrites the URL to strip out the query string, therefore I can't conclude for 100% sure that it's a proxy's fault. But I'm still pretty confident it is the reverse proxy's doing in the case of Misskey due to the observation I mentioned earlier where the generated file URLs that never got accessed don't get cached.
   
   Alright I'm done with this shit, #fediverse devs, do whatever with this info with mind :seija_coffee:
   
   #reverseproxy #fediversemeta
   
   RE: https://makai.chaotic.ninja/notes/9qhpixnwgx

   • Embed this notice
     :blobcathug: (jain@blob.cat)'s status on Tuesday, 05-Mar-2024 19:28:00 JST :blobcathug:

     in reply to
     @mima there are multiple ways:
     tbh that could be fixed within *oma since there is a mediaproxy cache blacklist as well as the option to invalidate cache via http or a bash script.
     tbh i didn't have time to set any of that up correctly.
     On the other hand, if you send media through fedi, then the media reached the public internet and deletion from the public internet is impossible anyway, especially for the fediverse by design of the protocol
   • Embed this notice
     :blobcathug: (jain@blob.cat)'s status on Tuesday, 05-Mar-2024 19:45:39 JST :blobcathug:

     in reply to
     @mima sorry, i guess i wrote it wrong, *oma implemented it already, i just never used/configured it and dont know if it really works that well...
     
     For OP's case i wouldnt have a fear from it since every file is only accessible from a high entropy url which cant be guessed. If that happens within my instance i guess it should be purged within the orphaned object cleaning task or manually if i get asked
   • Embed this notice
     :mima_rule: Mima-sama (mima@makai.chaotic.ninja)'s status on Tuesday, 05-Mar-2024 19:45:40 JST :mima_rule: Mima-sama

     in reply to

     • :blobcathug:

     @Jain@blob.cattbh that could be fixed within *oma since there is a mediaproxy cache blacklist as well as the option to invalidate cache via http or a bash script.Interesting. :sagume_think: Hope #Pleroma and #Akkoma consider those approaches. :cirno_fumo_yes:On the other hand, if you send media through fedi, then the media reached the public internet and deletion from the public internet is impossible anyway, especially for the fediverse by design of the protocolThe case of the OP is that the post (and therefore attached media as well) haven't even been queued up for federation yet because it's not yet submitted, yet the attachments get immediately uploaded to the home instance anyway, and this can be a problem if you've accidentally misclicked or touched a way too sensitive file while in the upload form.